The first BlackBerry device, the 850, was introduced in 1999 as a two-way pager. Over time, the devices evolved to include phone capability and moved to converged mobile telephone networks. The company enjoyed a significant lead in both the consumer and enterprise markets. Then it ran head-first into Apple’s iPhone, and took further hits as a multitude of Android-based mobiles entered the market.
For individuals, BlackBerries were a tremendous advance over basic mobile phones with only SMS. PIN-to-PIN messaging freed them from the grip of expensive per-SMS charges, and were theoretically encrypted. (Only years later did individual BlackBerry users learn that the shared keys in use rendered that encryption essentially worthless.) Email to the phone was a game changer, and followed closely thereafter by the ability to synchronize calendar and contact information.
For corporations, the BlackBerry was an unprecedented mobile tool. At the time it was introduced, Microsoft Exchange and Lotus Notes were the predominate corporate email systems. The POP3 and IMAP protocols existed for message retrieval, but SSL/TLS encryption was not ubiquitous. Few organizations were willing to expose these protocols to the Internet. BlackBerry Enterprise Server (BES) provided an effective solution. Companies could install BES and connect it to their existing Exchange or Notes system. BES then established a connection to the BlackBerry data center, which in turn facilitated communication with BlackBerry handhelds.
Unlike the consumer service, BES enabled corporations to manage their own cryptographic keys, although few did, and provided mobile device management that shaped the industry. BES included features such as remote provisioning, managing device security policies, restricting application installations, message logging, and remote wipe functionality. In the era of corporate-issued devices, it was an ideal fit.
The Apple iPhone and lower cost mobile devices running Google’s Android operating system became serious challengers, but it took several years for Mobile Device Management (MDM) to mature to the point where iOS and Android devices offered enterprise customers a comparable level of control to BlackBerry. During this time, a rich application ecosystem formed around iOS and Android, prying away BlackBerry’s share of the consumer market.
Diehard BlackBerry fans remained loyal due to the physical keyboard, and in some market segments the exclusive ability to exchange PIN-to-PIN messages with corporate BlackBerry users remained highly advantageous. Somewhat ironically, BlackBerry killed that advantage by launching the free BlackBerry Messenger (BBM) for iOS and Android.
For the past few years, BlackBerry focused almost exclusively on the enterprise market, as if they were betting familiarity and security would keep them alive. They took a bold leap and switched their operating system to Android. While the move opened up BlackBerry to the full suite of Google Play Apps, from a security perspective it was difficult to reconcile. BlackBerry spun the DTEK50 as, “The World’s Most Secure Android Smartphone.” There is no such thing as a secure smartphone that runs Android and loads apps from Google Play. BlackBerry’s move to Android eliminated their remaining security advantage.
To be fair, demand for secure mobile phones appears very low. Given the choice between a high-security device and the ability to load apps, the apps win almost every time. It may, in fact, not have been viable for BlackBerry to continue maintaining its own operating system. But regardless of how they arrived there, BlackBerry had little, if anything, left to distinguish its products from other MDM-capable mobiles.
BlackBerry’s future remains to be seen. Given the vast Apple App Store and Google Play ecosystems, it is highly unlikely the company will regain traction in the consumer market. Their BBM app is only installed by iOS and Android users who need to communicate with BlackBerry owners; beyond that it provides little value. Other free apps provide more secure and reliable IM functionality.
Perhaps as a software company, BlackBerry will develop a more secure smartphone operating system or improvements to Android. The security of Android phones is primarily limited by the applications installed. An up-to-date Android phone with minimal applications can be reasonably secure, provided that the phone vendor issues timely patches. Those patches are problematic for some vendors, possibly BlackBerry has a solution for them.
Apple, often criticized in early days for strictly policing their app store, maintains tight controls over what applications are allowed to do. As a result, the likelihood of malware in the Apple App Store is lower. However, vulnerabilities have been found, and malware remains a possibility in the iOS ecosystem. Maybe BlackBerry can help reduce risks related to downloads from Google Play.
Ideally, BlackBerry, once a Canadian treasure, will double down on security, improve their game, team up with a leading Android-based phone manufacturer, and actually bring a more secure phone to market.
Have a security question you’d like answered in a future column? Email email@example.com
SAMSUNG GALAXY S8 PLUS
The Samsung Galaxy S8 Plus is a beautifully crafted smartphone with nearly no bezel, curvaceous in design and reflects a…
How to: Connect to Exchange Online Using Multi-Factor Authentication
Using PowerShell to manage your Microsoft cloud services like Exchange Online and using multi-factor authentication (MFA) separately is awesome. Using…